6069efe2b1a5cdf837ac7c4c6a1f107387711ebad0ecfc793980ee92475f03a8

Analysis

max time kernel
26s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 07:44

Target

541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.exe
Size

6.3MB
MD5

aa4e99b717bcb7e916148a469e69788a
SHA1

42fc554d8442a78a48dc624d3de59ae4515eed6d
SHA256

541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219
SHA512

c6127eb47a24df060e8d81f95dd3fd4d0118b6fefbd38b25e6f23ac11f4ebdd0eecb61ddd79ef0cc9c4e52cdd36e823f99d5be389141f5ac9cead1b95d33f4ca
SSDEEP

98304:knDGGNXjcnVUySYboN7jREuF26pv9cYqVismqW:WN6Uy5kNaULel

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1588	2012	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.exe	28
PID 2012 wrote to memory of 1588	2012	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.exe	28
PID 2012 wrote to memory of 1588	2012	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.exe	28
PID 1588 wrote to memory of 1492	1588	cmd.exe	29
PID 1588 wrote to memory of 1492	1588	cmd.exe	29
PID 1588 wrote to memory of 1492	1588	cmd.exe	29

C:\Users\Admin\AppData\Local\Temp\541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.exe
"C:\Users\Admin\AppData\Local\Temp\541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\cmd.exe
  cmd /C "net use \\10.10.3.42\c$ 23AS32df21 /user:adm-karsair"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\system32\net.exe
    net use \\10.10.3.42\c$ 23AS32df21 /user:adm-karsair
    3⤵
    PID:1492